@livx.cc/appwrap 0.32.0 → 0.35.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/appwrap",
-  "version": "0.32.0",
+  "version": "0.35.0",
   "description": "Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).",
   "license": "MIT",
   "author": "Elya Livshitz",

package/runtime/app/main-page.ts

@@ -55,6 +55,32 @@ function traceIosLifecycle(): void {
   appwrapNativeLog('[native:lifecycle] tracer armed');
 }
 
+/** iOS-only GLOBAL native-surface freeze recovery. Registers ONE observer on
+ * UIWindowDidBecomeHiddenNotification: whenever ANY window becomes hidden — which happens when ANY
+ * native modal/drawer/sheet dismisses (StoreKit manage-subscriptions sheet, OAuth session, share,
+ * pickers, Safari, alerts) — we run CustomWebView.recoverAfterNativeSurface(). That covers the
+ * pathological case where a same-scene system sheet dismisses with ZERO app-lifecycle events (no
+ * resumeEvent, no background) yet orphans an interactive UITrackingElementWindow above ours that
+ * swallows touches → WebView alive but frozen.
+ *
+ * WHY this generalizes the per-handler wiring: future native surfaces need NO per-handler call —
+ * the dismiss inherently hides a window, so this fires. The 5 existing per-handler calls remain
+ * (proven baseline); they become redundant once this observer is DEVICE-VERIFIED to fire on the
+ * StoreKit-sheet dismiss and catch the orphan at ~350ms.
+ *
+ * SAFE/CONSERVATIVE: recoverAfterNativeSurface is additive + idempotent (no stray window ⇒ no-op),
+ * COALESCES a notification burst (several windows hide per dismiss) into ONE pass, and only acts on a
+ * window's HIDE (dismiss), never on a window appearing — so legitimate window stacking is untouched. */
+let _surfaceRecoveryArmed = false;
+function armNativeSurfaceRecovery(webView: CustomWebView): void {
+  if (_surfaceRecoveryArmed) return;
+  _surfaceRecoveryArmed = true;
+  NSNotificationCenter.defaultCenter.addObserverForNameObjectQueueUsingBlock(
+    UIWindowDidBecomeHiddenNotification, null, null, () => webView.recoverAfterNativeSurface()
+  );
+  if (SHELL_CONFIG.debug) appwrapNativeLog('[native:recover] global UIWindowDidBecomeHidden observer armed');
+}
+
 export function onPageLoaded(args: EventData): void {
   const page = args.object as Page;
   page.bindingContext = { backgroundColor: SHELL_CONFIG.backgroundColor };
@@ -90,6 +116,7 @@ export function onPageLoaded(args: EventData): void {
 
   const webView = page.getViewById<CustomWebView>('webview');
   bridge.attach(webView);
+  if (isIOS) armNativeSurfaceRecovery(webView); // global freeze-recovery on any native modal dismiss
   if (isAndroid) wireAndroidSafeArea(webView); // experimental edge-to-edge (no-op unless config on)
   startEventForwarding();
   loadBundle(webView);

package/runtime/app/shell/capabilities.manifest.ts

@@ -254,6 +254,22 @@ export const MODULES: ModuleManifest[] = [
     nativeSrc: 'health',
   },
 
+  // ── tracking — App Tracking Transparency (iOS) — opt-in, STRIPPABLE (own handler + group) ──
+  // The native-only store-compliance seam for cross-company tracking (IDFA / cross-app identity):
+  // Apple REQUIRES the ATT prompt + NSUserTrackingUsageDescription and forbids tracking before
+  // consent. iOS-only (`ios:true`/`android:false`) — Android has NO ATT (the kit reports the cap
+  // 'none' there and degrades honestly). Stamping NSUserTrackingUsageDescription is what tells Apple
+  // the app tracks, so it's gated behind THIS module being active (no string = Apple assumes none).
+  // The CLI also flips the privacy manifest's NSPrivacyTracking → true + fills NSPrivacyTrackingDomains
+  // (from config `trackingDomains`) only when this module is active. iOS links
+  // AppTrackingTransparency.framework lazily via the runtime FFI (no extra link flag needed for a
+  // weak-import system framework referenced through NativeScript's interop). No native deps.
+  {
+    name: 'tracking', group: 'tracking',
+    capabilities: { tracking: { ios: true, android: false } },
+    ios: { permissions: [{ key: 'NSUserTrackingUsageDescription', domain: 'tracking', defaultUsage: 'Allow tracking to deliver a more personalized experience and measure ad performance.' }] },
+  },
+
   // ── backgroundTask — headless background execution (HEADLESS JS HANDLER) — opt-in, STRIPPABLE ──
   // The OS wakes the app (possibly cold, no visible WebView) for a permitted task id; the shell builds
   // an OFFSCREEN WebView, loads the app conveying the id (the handshake reports it), awaits the JS
@@ -273,7 +289,7 @@ export const MODULES: ModuleManifest[] = [
 
 /** Opt-in registration groups that own their own NS handler file (strippable when inactive). Core
  * groups (core/extended/parity/system/media/billing) are always bundled; only these are CLI-gated. */
-export const OPTIONAL_GROUPS = ['health', 'oauth', 'reviews', 'scanner', 'speech', 'backgroundTask'] as const;
+export const OPTIONAL_GROUPS = ['health', 'oauth', 'reviews', 'scanner', 'speech', 'tracking', 'backgroundTask'] as const;
 
 /** Resolve the active capability map for the handshake from a set of active capability names. */
 export function buildCapabilityMap(

package/runtime/app/shell/custom-webview.ios.ts

@@ -113,14 +113,25 @@ export class CustomWebView extends WebView {
     );
   }
 
+  /** Coalesce flag: at most one pending recovery pass at a time (see recoverAfterNativeSurface). */
+  private _recoveryPending = false;
+
   /** Call after dismissing ANY native surface presented over the WebView (StoreKit sheet, OAuth
    * ASWebAuthenticationSession, SFSafariViewController, pickers, share, alerts). Such surfaces can
    * leave the WebView frozen: a same-scene system sheet doesn't fire resumeEvent AND can orphan an
    * interactive window above ours that swallows touches. We neutralise any stray window FIRST (so the
    * wake re-attaches over a clean stack), then wake. Deferred so the dismissal animation finalizes the
-   * orphan window first. Idempotent + safe (no stray ⇒ no-op). No-op on Android. */
+   * orphan window first. Idempotent + safe (no stray ⇒ no-op). No-op on Android.
+   *
+   * COALESCED: a single dismiss fires UIWindowDidBecomeHiddenNotification multiple times and several
+   * windows can hide at once (the global observer in main-page.ts), so we collapse a burst to ONE pass
+   * via _recoveryPending rather than stacking dozens of 350ms timers. The per-handler callers also
+   * route through this, so handler + observer firing for the same dismiss = one recovery. */
   recoverAfterNativeSurface(): void {
+    if (this._recoveryPending) return;
+    this._recoveryPending = true;
     setTimeout(() => {
+      this._recoveryPending = false;
       try { this.neutralizeStrayWindows(); } catch (e) { /* best-effort */ }
       this.wakeWebContent();
     }, 350);

package/runtime/app/shell/events.ts

@@ -26,7 +26,18 @@ export function onDeepLink(url: string): void {
   // plumbing, not an app deep link, so it's swallowed here and never forwarded to the PWA.
   if (deepLinkInterceptor?.(url)) return;
   if (pwaReady) bridge.emit('deeplink.open', { url });
-  else pendingDeepLink = url; // buffer until the PWA handshakes
+  else pendingDeepLink = url; // buffer until the PWA handshakes — delivered IN the handshake response
+}
+
+/**
+ * Hand the cold-start deep link back IN the handshake response (read-once), so the PWA knows the
+ * target route BEFORE first paint and routes immediately — no `/home` flash, no fragile event timer.
+ * Returns null when the launch wasn't from a link (or it was already consumed / delivered warm).
+ */
+export function consumePendingDeepLink(): string | null {
+  const url = pendingDeepLink;
+  pendingDeepLink = null;
+  return url;
 }
 
 /** A home-screen shortcut was activated (iOS performActionForShortcutItem / cold-start launchOptions;
@@ -47,18 +58,15 @@ export function onPushTap(payload: { data: Record<string, string> }): void {
 }
 
 /**
- * The PWA completed app.handshake → its JS is live and registers its
- * lifecycle listeners right after kit.ready() resolves. Flush any deep link
- * that arrived during launch (cold start), after a beat for listener install.
+ * The PWA completed app.handshake → its JS is live and registers its lifecycle listeners right after
+ * kit.ready() resolves. A cold-start DEEP LINK is delivered IN the handshake response itself (see
+ * `consumePendingDeepLink`), so the PWA routes before first paint — it is NOT flushed here. Push taps
+ * and shortcuts still flush as events (after a beat for listener install) — they aren't route-shaped,
+ * so a flash isn't a concern and the event path is the established contract.
  */
 export function onPwaHandshake(): void {
   if (pwaReady) return;
   pwaReady = true;
-  if (pendingDeepLink) {
-    const url = pendingDeepLink;
-    pendingDeepLink = null;
-    setTimeout(() => bridge.emit('deeplink.open', { url }), 500);
-  }
   if (pendingPushTap) {
     const payload = pendingPushTap;
     pendingPushTap = null;

package/runtime/app/shell/handlers-billing.ts

@@ -221,6 +221,9 @@ export function registerBillingHandlers(): void {
         // The sheet dismisses WITHOUT the app scene leaving foregroundActive → no resumeEvent, and it
         // orphans a touch-stealing window above ours. Recover from this completion (the only callback
         // that fires). Shared across all native surfaces; see CustomWebView.recoverAfterNativeSurface.
+        // NOTE: redundant with the global UIWindowDidBecomeHidden observer (armNativeSurfaceRecovery in
+        // main-page.ts) — kept as the proven baseline; remove the per-handler calls once that observer
+        // is device-verified to fire on this dismiss. Double-recovery is safe (coalesced + no-op clean).
         bridge.getWebView()?.recoverAfterNativeSurface();
         if (message) reject(err('NATIVE_ERROR', message));
         else resolve();

package/runtime/app/shell/handlers-tracking.ts

@@ -0,0 +1,60 @@
+import { isIOS } from '@nativescript/core';
+import { bridge } from './bridge';
+
+const err = (code: string, message: string) => Object.assign(new Error(message), { code });
+
+/** Map the ATT status enum (ATTrackingManagerAuthorizationStatus: 0..3) to the kit's string union. */
+function statusToString(raw: number): 'notDetermined' | 'restricted' | 'denied' | 'authorized' {
+  switch (raw) {
+    case ATTrackingManagerAuthorizationStatus.Authorized: return 'authorized';
+    case ATTrackingManagerAuthorizationStatus.Denied: return 'denied';
+    case ATTrackingManagerAuthorizationStatus.Restricted: return 'restricted';
+    default: return 'notDetermined';
+  }
+}
+
+/**
+ * App Tracking Transparency (iOS, `tracking` module). Strippable own-handler file (registered only
+ * when the module is active) — a build without `tracking` compiles NO ATT code. Bridges the three kit
+ * calls to ATTrackingManager / ASIdentifierManager.
+ *
+ * iOS-only: the capability is gated `ios:true`/`android:false`, so the kit short-circuits these on
+ * other platforms (`capability !== 'native'`) before they ever reach the bridge. The isIOS guard is
+ * defence-in-depth so the handler is a no-op if ever loaded elsewhere.
+ *
+ * DEVICE-UNVERIFIED (compile-verified-only): the ATT prompt + IDFA round-trip cannot be exercised on a
+ * USB dev-sideload in this environment. The FFI selectors are verified against @nativescript/types-ios
+ * (ATTrackingManager.requestTrackingAuthorizationWithCompletionHandler / .trackingAuthorizationStatus,
+ * ASIdentifierManager.sharedManager().advertisingIdentifier). Same honesty bar as the other recent
+ * native modules (oauth/billing-sheet): the compile path is proven, on-device behavior is not.
+ */
+export function registerTrackingHandlers(): void {
+  if (!isIOS) return;
+
+  // requestPermission — show the ATT prompt; completion fires async with the chosen status. The
+  // completion runs off the main thread; we just translate + resolve. Dismiss-bound on the kit side
+  // (timeoutMs:'none') — the user decides at their leisure.
+  bridge.register('tracking.requestPermission', () =>
+    new Promise((resolve, reject) => {
+      try {
+        ATTrackingManager.requestTrackingAuthorizationWithCompletionHandler((status: number) => {
+          resolve(statusToString(status));
+        });
+      } catch (e: any) {
+        reject(err('NATIVE_ERROR', e?.message ?? 'tracking.requestPermission failed'));
+      }
+    })
+  );
+
+  // status — current authorization WITHOUT prompting.
+  bridge.register('tracking.status', () => statusToString(ATTrackingManager.trackingAuthorizationStatus));
+
+  // idfa — the advertising identifier, ONLY while authorized; else undefined. iOS returns an all-zero
+  // UUID when not authorized, so we gate on the status AND filter the placeholder.
+  bridge.register('tracking.idfa', () => {
+    if (ATTrackingManager.trackingAuthorizationStatus !== ATTrackingManagerAuthorizationStatus.Authorized) return undefined;
+    const id = ASIdentifierManager.sharedManager().advertisingIdentifier?.UUIDString;
+    if (!id || id === '00000000-0000-0000-0000-000000000000') return undefined;
+    return id;
+  });
+}

package/runtime/app/shell/handlers.ts

@@ -1,7 +1,7 @@
 import { ApplicationSettings, Utils, isAndroid, isIOS } from '@nativescript/core';
 import { bridge } from './bridge';
 import { SHELL_CONFIG } from './config';
-import { onPwaHandshake } from './events';
+import { onPwaHandshake, consumePendingDeepLink } from './events';
 import { showToast } from './toast';
 import { showBanner, dismissBanner } from './banner';
 import { setStatusBarStyle } from './status-bar';
@@ -10,7 +10,7 @@ import { ACTIVE_MODULE_NAMES } from './active-modules.generated';
 import { consumePendingBackgroundTaskId } from './background-context';
 
 /** Build identifier for the native shell bundle — bump per deploy to spot stale bundles. */
-export const SHELL_BUILD = 'updates-devmenu-3';
+export const SHELL_BUILD = 'global-observer-1';
 
 /** Version status the web side (native-kit `kit.updates`) reports via `app.reportWebVersion`. */
 export interface WebVersionInfo { current?: string; latest?: string; build?: string | number; updateAvailable?: boolean; }
@@ -32,6 +32,10 @@ export function registerHandlers(): void {
     // (offscreen) WebView. Report it so `kit.backgroundTask` dispatches the registered handler. Consumed
     // (read-once) so a later foreground handshake in the same process never re-reports a stale wake.
     const backgroundTaskId = consumePendingBackgroundTaskId();
+    // A cold-start deep link buffered during launch is handed back HERE (read-once) so the PWA routes
+    // to the target before first paint — no `/home` flash. Warm links (app already running) still
+    // arrive via the `deeplink.open` event.
+    const deepLink = consumePendingDeepLink();
     return {
       protocol: 1,
       platform: isIOS ? 'ios' : 'android',
@@ -39,6 +43,7 @@ export function registerHandlers(): void {
       debug: { lastNotifTap: safeJson(ApplicationSettings.getString('kit:__notifTap', '')) },
       capabilities,
       ...(backgroundTaskId ? { backgroundTaskId } : {}),
+      ...(deepLink ? { deepLink } : {}),
     };
   });
 

package/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "appwrap-shell",
   "main": "app/app.ts",
-  "version": "0.30.0",
+  "version": "0.32.0",
   "private": true,
   "scripts": {
     "dev:ios": "ns run ios",

package/runtime/references.d.ts

@@ -21,3 +21,5 @@
 /// <reference path="./node_modules/@nativescript/types-ios/lib/ios/objc-x86_64/objc!BackgroundTasks.d.ts" />
 /// <reference path="./node_modules/@nativescript/types-ios/lib/ios/objc-x86_64/objc!AuthenticationServices.d.ts" />
 /// <reference path="./node_modules/@nativescript/types-ios/lib/ios/objc-x86_64/objc!Photos.d.ts" />
+/// <reference path="./node_modules/@nativescript/types-ios/lib/ios/objc-x86_64/objc!AppTrackingTransparency.d.ts" />
+/// <reference path="./node_modules/@nativescript/types-ios/lib/ios/objc-x86_64/objc!AdSupport.d.ts" />

package/src/cli.ts

@@ -29,6 +29,7 @@ import {
   stampAndroidQueries,
   stampPlistBackgroundTasks,
   stampPlistOrientations,
+  stampPrivacyTracking,
 } from './derive';
 import type { WebManifest } from './derive';
 
@@ -177,6 +178,7 @@ const OPTIONAL_GROUP_HANDLERS: Record<string, { file: string; fn: string }> = {
   reviews: { file: './handlers-reviews', fn: 'registerReviewsHandlers' },
   scanner: { file: './handlers-scanner', fn: 'registerScannerHandlers' },
   speech: { file: './handlers-speech', fn: 'registerSpeechHandlers' },
+  tracking: { file: './handlers-tracking', fn: 'registerTrackingHandlers' },
   backgroundTask: { file: './handlers-background', fn: 'registerBackgroundTaskHandlers' },
 };
 
@@ -253,6 +255,19 @@ function stampEntitlements(outDir: string, cfg: AppwrapConfig, req: NativeReqs):
   console.log(`  entl ← ${keys.join(', ')}`);
 }
 
+/** Stamp the App Tracking Transparency declarations into the store-readiness privacy manifest
+ * (PrivacyInfo.xcprivacy). EXTENDS that single manifest — flips NSPrivacyTracking + fills
+ * NSPrivacyTrackingDomains only when the `tracking` module is active, else leaves the template's
+ * `false` + empty defaults. Idempotent both ways (a build that later drops the module resets them). */
+function stampPrivacyManifest(outDir: string, cfg: AppwrapConfig, req: NativeReqs): void {
+  const file = join(outDir, 'App_Resources/iOS/PrivacyInfo.xcprivacy');
+  if (!existsSync(file)) return;
+  const active = req.activeOptionalGroups.includes('tracking');
+  const next = stampPrivacyTracking(readFileSync(file, 'utf8'), active, cfg.trackingDomains ?? []);
+  writeFileSync(file, next);
+  if (active) console.log(`  priv ← NSPrivacyTracking=true${cfg.trackingDomains?.length ? ` (${cfg.trackingDomains.length} domain${cfg.trackingDomains.length > 1 ? 's' : ''})` : ''}`);
+}
+
 /** Copy active modules' native source (runtime/modules-native/<name>/) into native/ — only when the
  * module is active, so module native code stays stripped from builds that don't use it. */
 function copyModuleNativeSrc(outDir: string, req: NativeReqs): void {
@@ -935,15 +950,28 @@ function gitRoot(start: string): string {
   }
 }
 
+/** True when `root` is the appwrap framework monorepo itself (not an external consumer project).
+ * Running `appwrap init` on an in-repo example (examples/*) resolves `gitRoot` to the framework root,
+ * so scaffolding consumer CI workflows there pollutes the framework's OWN `.github/workflows` with a
+ * stray app-template workflow each init. The framework manages its own CI — skip the workflow scaffold. */
+export function isFrameworkRepo(root: string): boolean {
+  return existsSync(join(root, 'packages/appwrap-cli/src/cli.ts'));
+}
+
 /** Emit CI scaffolding (GH Actions → git repo root, fastlane → native/). Never overwrites. */
 function copyCiTemplates(cwd: string, outDir: string, cfg: AppwrapConfig): void {
   if (!existsSync(CI_TEMPLATE_DIR)) return;
+  const repoRoot = gitRoot(cwd);
   // GitHub only reads `.github/workflows` at the REPO ROOT — in a monorepo, writing it under the
   // package cwd (e.g. packages/app/.github) is dead config and regenerates a stray workflow each init.
-  const targets: Array<[string, string]> = [
-    [join(CI_TEMPLATE_DIR, 'github/workflows'), join(gitRoot(cwd), '.github/workflows')],
-    [join(CI_TEMPLATE_DIR, 'fastlane'), join(outDir, 'fastlane')],
-  ];
+  const targets: Array<[string, string]> = [[join(CI_TEMPLATE_DIR, 'fastlane'), join(outDir, 'fastlane')]];
+  // …but if the repo root IS the appwrap framework itself (in-repo example), DON'T scaffold consumer
+  // workflows into the framework's .github — that's the stray-workflow-each-init bug.
+  if (isFrameworkRepo(repoRoot)) {
+    console.log('  ci   ← GH Actions scaffold skipped (inside the appwrap framework repo — manages its own CI)');
+  } else {
+    targets.unshift([join(CI_TEMPLATE_DIR, 'github/workflows'), join(repoRoot, '.github/workflows')]);
+  }
   for (const [from, to] of targets) {
     mkdirSync(to, { recursive: true });
     cpSync(from, to, { recursive: true, force: false, errorOnExist: false });
@@ -959,7 +987,10 @@ function copyCiTemplates(cwd: string, outDir: string, cfg: AppwrapConfig): void
       .replaceAll('__TEAM_ID__', cfg.teamId ?? '');
     writeFileSync(p, stamped);
   }
-  console.log('  ci   ← GH Actions (.github/workflows) + fastlane (native/fastlane, signing stamped) — see secrets contract in workflow headers');
+  const ci = isFrameworkRepo(repoRoot)
+    ? '  ci   ← fastlane (native/fastlane, signing stamped) — see secrets contract in workflow headers'
+    : '  ci   ← GH Actions (.github/workflows) + fastlane (native/fastlane, signing stamped) — see secrets contract in workflow headers';
+  console.log(ci);
 }
 
 /**
@@ -997,6 +1028,7 @@ function regenerateCore(cwd: string, outDir: string, cfg: AppwrapConfig, opts: {
   stampStoreKit(cwd, outDir, cfg);
   stampPush(cwd, outDir, cfg);
   stampEntitlements(outDir, cfg, req); // unified app.entitlements: module entitlements + push aps-environment
+  stampPrivacyManifest(outDir, cfg, req); // ATT tracking declarations into the store-readiness privacy manifest
   generateIcons(cwd, outDir, cfg);
   copyPwa(cwd, outDir, cfg);
 }

package/src/config.ts

@@ -109,8 +109,14 @@ export interface AppwrapConfig {
    * (iOS: Info.plist usage string; Android: <uses-permission>). 'contacts' has no
    * iOS key (CNContactPicker needs none) — it only stamps Android READ_CONTACTS. */
   permissions?: Partial<
-    Record<'location' | 'photos' | 'camera' | 'microphone' | 'faceid' | 'calendar' | 'contacts' | 'motion', string>
+    Record<'location' | 'photos' | 'camera' | 'microphone' | 'faceid' | 'calendar' | 'contacts' | 'motion' | 'tracking', string>
   >;
+  /** App Tracking Transparency tracking domains (iOS, `tracking` module). When the module is active
+   * the CLI sets the privacy manifest's `NSPrivacyTracking` → true and fills `NSPrivacyTrackingDomains`
+   * with these (the hosts the app/embedded SDKs contact while tracking — Apple validates them at
+   * upload). Empty/absent → `NSPrivacyTracking` true with an empty domains array (declare the prompt
+   * without listing domains). No-op entirely when the `tracking` module is inactive. */
+  trackingDomains?: string[];
   /** Monotonic build identifier. Stores reject a re-upload unless this is HIGHER than the last:
    * iOS `CFBundleVersion`, Android `versionCode` (the marketing `version` stays the user-facing
    * string). Default: an integer derived from `version` (0.2.1 → 201). Set an explicit number from a

package/src/derive.ts

@@ -208,6 +208,33 @@ export function stampPlistBackgroundTasks(src: string, ids: string[] | undefined
   return src;
 }
 
+/**
+ * Stamp the App Tracking Transparency declarations into PrivacyInfo.xcprivacy. Rewrites the two
+ * tracking keys IN PLACE (the template ships them, so we never restructure the doc — we only flip
+ * values), keeping the required-reason API declarations the store-readiness manifest carries intact.
+ * Fully idempotent both directions:
+ *   - module ACTIVE   → `NSPrivacyTracking` true  + `NSPrivacyTrackingDomains` = `domains`.
+ *   - module INACTIVE → `NSPrivacyTracking` false + empty `NSPrivacyTrackingDomains` (template default).
+ * This EXTENDS the store-readiness manifest (single source of truth) rather than emitting a second one.
+ */
+export function stampPrivacyTracking(src: string, tracking: boolean, domains: string[] = []): string {
+  const list = (tracking ? domains : []).filter(Boolean);
+  // NSPrivacyTracking — true/false. Match the key + its following <true/>|<false/> element.
+  src = src.replace(
+    /(<key>NSPrivacyTracking<\/key>\s*)<(?:true|false)\/>/,
+    `$1<${tracking ? 'true' : 'false'}/>`
+  );
+  // NSPrivacyTrackingDomains — empty <array/> or a populated <array>…</array>. Match either form.
+  const domXml = list.length
+    ? `<array>\n${list.map((d) => `\t\t<string>${d}</string>`).join('\n')}\n\t</array>`
+    : `<array/>`;
+  src = src.replace(
+    /(<key>NSPrivacyTrackingDomains<\/key>\s*)(?:<array\/>|<array>[\s\S]*?<\/array>)/,
+    `$1${domXml}`
+  );
+  return src;
+}
+
 export function stampAndroidQueries(src: string, queryPackages?: string[], queryUrlSchemes?: string[]): string {
   const children = [
     ...(queryPackages ?? []).map((p) => `\t\t<package android:name="${p}"/>`),